Categories

Network

Users can now check whether their network is exposed to Mirai, one of the most prolific botnets to have targeted Internet of Things (IoT) devices this year.

The botnet was initially detailed in early September, but it became more popular in early October, when its author released the source code online. The malware, designed to harness the power of insecure IoT devices to launch distributed denial of service (DDoS) attacks, had been previously used in massive incidents targeting Brian Krebs' blog and hosting provider OVH.

With the primary purpose of IoT botnets being DDoS attacks, it’s no wonder that Akamai said that Mirai wasn’t alone in the 665 gigabit per second (Gbps) attempt to take down Krebs. However, security researchers reported that Mirai was increasingly used in DDoS incidents following the source code leak.

One such Mirai attack targeted DNS provider Dyn and disrupted popular websites such as Twitter, Etsy, GitHub, Soundcloud, PagerDuty, Spotify, Shopify, Airbnb, Intercom and Heroku. With infected devices in 164 countries and the use of Internet protocols that aren’t usually associated with DDoS attacks, such as STOMP floods, Mirai continues to wreak havoc.

Because Mirai’s success is fueled by the existence of IoT devices that aren’t properly secured, it could be easily countered by simply changing the default credentials on vulnerable devices and by closing the Telnet port the botnet uses for infection. That, however, is an operation that users and network admins need to perform, but they might not always be aware of such an issue impacting them.

To help users determine whether their network is exposed to Mirai or not, IoT Defense Inc., a startup company based in the Washington DC Metro area, launched a web scanner that does exactly that: it searches for opened TCP ports and informs users whether they are safe or not.

The IoT Defense scanner was written using a combination of Python, Node JS and Jade frameworks and scans for nearly a dozen ports that botnets can exploit. Accessing and using the scanner is free and little instructions are needed, as it does all with a simple click of a button.

While not all of these ports are targeted by Mirai, a couple are, with the 2323 Telnet port being specifically attacked. The IoT botnet scans the Internet for exposed IoT devices such as routers, IP cameras, and DVRs, and, when it finds vulnerable devices, it attempts to login to them using a list of default login credentials.

This, however, is a behavior employed by other botnets as well. What’s more, while disinfecting a device compromised by Mirai is very easy, because a simple reboot would suffice, keeping the malware away from that device is more complicated. Because of constant scans, vulnerable IoT products are re-infected within minutes.

Device vendors are those who need to take action, because users rarely do so T. Roy, CEO, IoT Defense, told SecurityWeek via email. They should add in-field auto-updates to their devices, should use per device unique passwords (something that router manufacturers have already started implementing), and should not open up unnecessary ports.

Because their incentives are not aligned with device vendors, it’s clear that users might not be the ones to fix this issue. Users might not care – provided that they are aware of an issue – that their routers, IP cameras, or DVRs are used to DDoS websites and DNS providers. As long as the bandwidth usage doesn’t affect them, they are not disadvantaged, and T. Roy believes that one solution would be for ISPs to impose bandwidth caps.

A set of rules to impose stricter security of IoT devices would also be of help, and steps in this direction are already being taken, with the Department of Homeland Security (DHS) publishing its Strategic Principles for Securing the Internet of Things. The document includes six non-binding principles designed to provide security across the design, manufacturing and deployment of connected devices.

IoT Defense’s CEO also notes that IoT vendors need to have a servicing model in place, to resolve vulnerabilities in their devices when they are discovered. Just as it happens with many other products, vendors would be given a window to resolve the found issues or face consequences. However, he isn’t very optimistic about vendors actually taking stance.

“As of today, IoT device manufacturers have very little to show for security which always gets trumped by new features and time or market concerns. It is wishful thinking to expect device vendors to step up their game and make security and privacy key differentiators for their products,” T. Roy said.

Last year, Gartner said that the number of connected devices will grow above the 20 billion mark by 2020. Now, Juniper Research estimates that there will be 38.5 billion connected IoT devices by that year, and that 70% of these units are expected to be non-consumer devices. Should the level of insecurity within these devices remain the same, the consequences will be dire for consumers, enterprises, and vendors alike.

The good news, however, is that even today enterprises block inbound open external access over protocols such as Telnet and SSH, meaning that IoT devices within corporate environments aren’t exposed. However, as Zscaler points out, these devices remain vulnerable nonetheless, and steps should be taken to defuse the situation, including automating the security and firmware updates and enforcing default password change at initial setup.

The issue at hand remains the existence of not only hundreds of thousands of IoT devices infected with Mirai, but also of hundreds of thousands more vulnerable to the botnet. More importantly, while the main purpose of IoT malware is the launch of DDoS attacks, cybercriminals have focused mainly on infecting complex devices, but could switch to simpler products such as smart toys, home appliances, wearables, and more, which would result in a flood of IoT malware all around us.

T. Roy agrees with that as well: “The day is not too far when Ransomware is going to straddle the boundary between the PC and the smart devices in the consumer's home. Unlike PC based ransomware where your pictures and videos are at stake, with everything being controlled by your smart devices your life and property are at stake.”

“Regulation will likely be the fix for IoT security,” F5 Networks evangelist David Holmes notes in a SecurityWeek column, citing Mikko Hypponen, Chief Risk Officer of F-Secure. However, he also explains that Internet security cannot be regulated like other manufacturing processes. Increasing awareness among users could also help resolve this issue, with the IoT Defense scanner being a small step in this direction.

As we approach Thanksgiving in the U.S., the one thing I look forward to the most — aside from turkey and spending time with my family — is football. As I watch the games, the security geek in me can’t help but notice some parallels between football and network security, particularly firewalls and intrusion prevention.

Network Security Playbook

During a passing play, for example, the tailback needs to protect the quarterback from any defender who breaks through the offensive line. That is critical to the success of the specific play and the quarterback’s long-term health. A firewall is like that offensive line. Even the latest next-generation firewalls (NGFW) occasionally allow threats to break through. Your organization needs a game plan for blocking those attacks that get past the firewall.

That’s why it makes sense to deploy a next-generation intrusion prevention system (IPS) behind your NGFW. By complementing the protection provided by a NGFW, the IPS can stop attacks that firewalls miss, such as those launched from within the enterprise, zero-day attacks, mutated threats, obfuscated exploits and attacks embedded in encrypted channels.

Why not use the built-in IPS capability found in most NGFWs? That’s certainly an option, if you take into the account the additional performance overhead needed to power the IPS feature and size the NGFW properly for your network. But even so, don’t forget about the internal segments of your network that need protection as well.

This an ideal use case for a standalone IPS, since it is a level 2 network device that just sits as a bump in the wire. There is no re-architecting needed to deploy it. You might also consider the fact that 55 percent of security professionals think that a standalone IPS is more effective that one built into a NGFW.

Read More About Firewalls and Securing Your Network

Teamwork Makes the Network

It is also important to remember that the IPS needs to be a good teammate to all the other security solutions you have already deployed, especially since it is capable of stopping threats at the point of attack. For example, your IPS should provide an out-of-the-box integration with your organization’s SIEM so that an attacker can be quarantined when an offense is detected.

Automating containment of threats reduces the spread of malware, halts an attacker’s subsequent lateral movement and stops additional data exfiltration. It’s important to choose an IPS that provides a web server application program interface (WSAPI) so that it can be integrated with the organization’s existing security products.

IBM Security Network Protection (XGS) is a next-generation intrusion prevention system that has a long track record of protecting against both known and unknown threats, often months or years before specific vulnerabilities are disclosed. Read our free solution brief, “A Firewall Is Just the Beginning When Securing Your Network,” to learn how you can significantly improve network security by deploying IBM XGS with your NGFW.

The Network Time Foundation's NTP Project has released version ntp-4.2.8p9 to address multiple vulnerabilities in ntpd. Exploitation of some of these vulnerabilities may allow a remote attacker to cause a denial-of-service condition.

“The malware is able to gain access to the gateway by logging into ACEmanager with the default password and using the firmware update function to download and run a copy of itself,” the company noted in a security advisory.

“Based on currently available information, once the malware is running on the gateway it deletes itself and resides only in memory. The malware will then proceed to scan for vulnerable devices and report its findings back to a command and control server. The command and control server may also instruct the malware to participate in a Distributed Denial of Service (DDoS) attack on specified targets.”

ICS-CERT pointed out that the malware does not exploit a software or hardware vulnerability in the gateway devices.

“The Mirai bot uses a short list of 62 common default usernames and passwords to scan for vulnerable devices. Because many IoT devices are unsecured or weakly secured, this short dictionary allows the bot to access hundreds of thousands of devices,” they explained, and added that with the recent release of the Mirai source code on the Internet, more IoT botnets are likely to be created.

Sierra Wireless has advised administrators of these devices to reboot the gateway to eliminate the malware (it resides in memory, so it will be automatically deleted), then immediately change the ACEmanager password to a unique, strong (complex and long) one.

Other attack mitigation options, such as disabling remote access on the devices and IP whitelisting, have been noted.

A recent survey from the Cloud Security Alliance and Skyhigh Networks, titled IT Security in the Age of Cloud,...

Enjoy this article as well as all of our content, including E-Guides, news, tips and more.

By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

showed a significant number of IT and security professionals are having trouble drinking from the proverbial security fire hose, and it just keeps getting more difficult. Nearly a third of the 228 respondents said they ignore network security alerts because there are too many false positives. Twenty-six percent of respondents said they receive more security alerts than they can investigate. These findings alone are not only a breach waiting to happen, but they essentially negate a significant portion of everything that has been done to improve security in the enterprise.

The study also found that 40% of respondents claim there's a lack of actionable intelligence in the network security alerts they do receive. What does that say about the security controls and processes they've invested in to this point? Oddly enough, a majority of respondents (53.7%) said their organizations plan to increase their security budget in the next 12 months. That begs the question: Are they just going to throw more money at the problem? The mantra is to simply invest more money and that will, presumably, fix everything. Unfortunately, information security programs aren't that simple. Quick fixes do not -- and never will -- work. What's needed to minimize these challenges in IT is a fresh look, and perhaps a significant retooling, of how information security is managed.

By and large, most problems related to network security alerts and the subsequent challenges and oversights are due to a lack of tuning of the security systems in use.

So how do IT and security pros move forward and get past this disarray with network security alerts? Everyone's situation is unique but there are some common strategies and tactics that can be utilized to gain some semblance of control over the situation. The first part is coming to an agreement on what matters. That is, what types of attacks against which specific systems in the network environment need the attention of IT and security staffs. This might involve enterprise applications in the DMZ combined with firewall and intrusion detection system (IDS) alerts. It might be internal-facing endpoints, perhaps involving DLP and malware protection. Whether it's external or internal, a security information and event management (SIEM) provider, managed security services provider or other entity might be involved. What new, or better, information is needed? Perhaps not enough information is being provided, or at least the right information, to help facilitate good decision-making?

I have found that, by and large, most problems related to network security alerts and the subsequent challenges and oversights are due to a lack of tuning of the security systems in use. Given the time constraints and lack of time management skills, combined with knowledge and training gaps related to products and security events -- what to look for -- many security systems are "set it and forget it." Unless there is continual measurement and subsequent tweaking of firewalls, IDS or intrusion prevention system, SIEM and the like, there's no possible way to achieve measurable improvements. Individual security systems must be treated as a feedback loop -- adjustments for which are then fed into the larger security program.

There are a lot of moving parts in properly setting and managing network security alerts, but the solution is simple. With user demands for simplicity and convenience, enterprises must set aside time and resources for this ongoing work to make security better. Otherwise, they're going through the motions, which serves to create a false sense of security and sets everyone involved up for failure over the long haul.